VNX-653: Improper Isolation or Compartmentalization

Field	Value
Rule ID	VNX-653
Severity	Low
SARIF level	note
Kind	sast
Languages	Python, JavaScript / TypeScript
CWE	CWE-653
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	sandbox isolation electron cwe-653
Source	internal/sast/rules/vnx-653.rego

Overview

VNX-653 maps to CWE-653: Improper Isolation or Compartmentalization. It reports two boundaries that look like isolation and are not:

• Python: exec()/eval() of a non-literal code argument whose globals replace __builtins__ with {}, None or a hand-picked dict, inline or through a globals name assigned that way in the same file.
• Electron (JavaScript/TypeScript files that import electron): contextIsolation: false, nodeIntegration: true, nodeIntegrationInSubFrames: true, nodeIntegrationInWorker: true and sandbox: false.

Not reported: exec/eval of a string literal, globals that keep the real __builtins__, code run in a separate process, the secure Electron values, sandbox: false outside an Electron file (payment SDK modes), comments and string literals. Arbitrary exec/eval of non-constant code is VNX-PY-002; vm.* is VNX-NODE-002.

Why This Matters

Removing builtins does not stop ().__class__.__base__.__subclasses__() from reaching os and subprocess, so the “sandboxed” code runs with the process’s privileges. In Electron, turning context isolation or the sandbox off gives any script in the page, including an XSS payload, Node.js and the preload’s APIs.

What Gets Flagged

exec(source, {"__builtins__": {}}, scope)              # FLAGGED
SAFE_GLOBALS = {"__builtins__": {}, "math": math}
return eval(formula, SAFE_GLOBALS, dict(variables))    # FLAGGED

webPreferences: {
  nodeIntegration: true,      // FLAGGED
  contextIsolation: false,    // FLAGGED
  sandbox: false              // FLAGGED
}

Remediation

1. Run untrusted code in a separate, unprivileged process (or container) with a timeout, or replace it with a real expression parser (ast.literal_eval, a small grammar).
2. In Electron keep contextIsolation: true, sandbox: true and nodeIntegration: false, and expose only narrow APIs through contextBridge.

References

• CWE-653: Improper Isolation or Compartmentalization
• Electron security checklist

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-653
// nosec vnx-653

Or record an ignore rule: vulnetix ignore add --rule vnx-653 --reason "...". See Suppressing findings.